Prisma SD-WAN will now generate Syslog messages on initial flow-rule classification and
end-of-flow for all flows handled by the ION device.
Where Can I Use
This?
What Do I Need?
Prisma SD-WAN
Active Prisma SD-WAN
license
Generate Syslog messages on initial flow-rule
classification and end-of-flow for all flows handled by the ION
device. These Syslog messages are in RFC 5424 format. You may configure
to export flow logs from an ION device to one or more Syslog servers.
The minimum device software version required for flow logging
is Release 5.1.17 or Release 5.2.3.
The Format of the flow log and description
of the different fields exported in the flow logs are listed below:
Some of the fields are reserved for future use, and therefore,
will not be populated in the flow log.
Field Name
Description
event time
Time event occurred on the ION device
src ip
Source IP address
dst ip
Destination IP address
dst port
Destination port
protocol name
Protocol name
reserved for future use
Field will be always blank in cgxFlowLogV1
reserved for future use
Field will be always blank in cgxFlowLogV1
pkts sent
Number of packets sent from src ip to dst
ip
pkts recvd
Number of packets received from dst ip by
src ip
bytes sent
Total bytes sent from src ip to dst ip
bytes recvd
Total bytes received from dst ip by src
ip
src interface
Interface from which traffic originated
dst interface
Interface from which traffic egressed
path id
Prisma SD-WAN Path ID of the WAN Path
app name
Name of Prisma SD-WAN-matched Application
flow event
Event that triggered flow export:
New
Flow
Flow Update
Delete Flow
zbfw classification rules
One or more ZBFW classification rules separated
by a semi-colon(;). ZBFW classification rules include:
Rule
Name: Source Zone Name: Destination Zone Name: Action: Action Code
ALLOW—Flow was Allowed
DENY—Flow was Denied
REJECT—Flow was rejected (Deny + Send
TCP RST)
UNK_SOURCE_ZONE_DENY—Flow was Denied
due to Unknown Source Zone
UNK_DESTINATION_ZONE_DENY—Flow was Denied
due to Unknown Destination Zone
UNK_SOURCE_DESTINATION_ZONE_DENY—Flow
was Denied due to Unknown Source and Destination Zone
Possible
Action Code Values:
1 = ALLOW
2 = DENY
3 = REJECT
4 = UNK_SOURCE_ZONE_DENY
5 = UNK_DESTINATION_ZONE_DENY
6 = UNK_SOURCE_DESTINATION_ZONE_DENY
Sample flow log in RFC 5424 format as shown below:
